The underserved and targeted: The shifting landscape of hacks and cyberattacks

In the past decade, most targeted attacks went after the larger enterprises that offered the bigger prize yet were more protected.

Important data including customer information through theft of credit cards and other personal information as well as the company IP are of value to adversaries. Now, these attacks can be broad-based through ingenious ways to get malware to anyone who visits the web through a drive by download or “malvertising” attack.

{mosads}Visit the web and you can become a victim. And the recent ransomware attacks don’t discriminate against their targets, no matter how small. These attacks manage to get by Fortune 50 companies with an unlimited cyber budget.

Can you imagine how defenseless a small business can be?

With these highly effective web-based attacks and still effective phishing campaigns occurring indiscriminately as to who is the target, small- and medium-sized businesses are in the crosshairs.

For the most part, security analysts seem to agree that if you protect the endpoint, you protect the enterprise. The endpoint is defined as a computer (laptop / desktop / tablet) a point-of-sale terminal or an ATM machine.

What they have in common is most are run by Microsoft Windows operating systems. Analysts also agree that layers of defense are critical to keeping malware out of your enterprise and to keep your important data safe.

This might be fine for large enterprises that can afford the many layers of defense systems and software and the people who can run those systems. Herein lies the rub with small- and mid-size businesses.

They flat-out can’t afford the systems or people to run the systems.

Does this leave them vulnerable?

Yes, it does and this is why they are underserved by our technology community and in many respects, our government.

Actual attacks on small businesses have reached 60 percent of all attacks according to the Securities and Exchange Commission, and this is not surprising. Indiscriminate attacks have no targets.

There are far more small businesses than large, with more than 28 million small business, according to the Federal Trade Commission, which has recently released tips and best practices in stopping breaches. The tips are basic and similar to what you will see from other government and non-government organizations.

Simple tasks like keeping software up to date, backing up files, using strong passwords and implementing two-factor authentication are usually in their recommendations. The problem is, you can do all this and still be breached by a criminal organization that seems to be one step ahead of traditional security vendors.

We read every day about the biggest enterprises getting breached, and they have multiple layers and complex security solutions in place. If a small business is breached, the effect could be crippling — many cannot recover.

As such, more must be done. Guidance from the FBI, security consultants and legal advisers on whether to pay the ransom requested by those holding their data and systems hostage is all over the place.

If a small business does not have their data backed up, is there really a choice? Even if the ransom is paid via bitcoin (difficult to track currency), there still is roughly a 50/50 chance the keys to unlock the data will not show up.

Small businesses can limit their risk.

Following tips as suggested earlier, constant training, or at the very least, constant mentioning to not open attachments from unknown people, backing up data and utilizing cloud services to access on demand data will help.

There are also emerging tech companies that take a very different approach from the traditional detection based security software companies. Additionally, the government should spend more time partnering with small innovative businesses rather than the big Silicon Valley brands.

Surely American innovation can stay ahead of criminal groups working out of their basement in the far stretches of the world.

Obviously the same old security technologies are not working.

Mike Fumai is the president and COO of AppGuard, a cybersecurity company.

The views expressed by contributors are their own and are not the views of The Hill.